Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Stateful Firewalling in 2811

we have one customer running the stateful inspection over a multilink interface. They claimed the stateful inspection caused them problems to surf the internet properly.

the configuration is as follows:


ip inspect name STATEFUL icmp

ip inspect name STATEFUL tcp

ip inspect name STATEFUL udp


interface Multilink1

ip address x.x.x.x

ip access-group xxx in

ip inspect STATEFUL out

no ip mroute-cache

load-interval 30

ppp multilink

ppp multilink group 1

service-policy output POL_AAA


policy-map POL_AAA

class CLASS_1

shape peak 4000000 4000000 2000000

class CLASS_2

shape peak 2000000 2000000 2000000

class CLASS_3

shape peak 144000 144000 112000

class class-default




the problem is, when surfing to some sites, the sites will display the "Error 502" and say "Remote server down or not responding"...and this appear on the site which has the link to the other address. Is that possible that the other address try to come in my router's interface using the same established session id (but now the source ip is different)? and the router just drop the packet? but in the access-list, we permit every address to come in anyway...

I hope i get my question right, 1 site which has a banner link from the other address can't be display, could it be possible that banner has difficulties to come in due to the stateful inspection?



Re: Stateful Firewalling in 2811

CreatePlease login to create content